- About Mr_IT_Guy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Mr_IT_Guy
A model citizen
Member since Aug 8, 2017
2 hours ago
Community Record
261
Posts
523
Kudos
7
Solutions
Badges
11-14-2019
05:56 AM
1 Kudo
So it seems like to me your phone may be looking for a specific tagged vLAN. If the phone doesn't see that vLAN then it will assume it does not have an IP address even if other devices may work. I would have your IT personnel check to make sure the PBX (phone server) does not have any settings like that. Additionally, it may be wise to have your IT team check to make sure there aren't any firewall rules that may be interfering.
... View more
11-14-2019
05:04 AM
1 Kudo
@PhilipDAth wrote: > not recognize my company's IP address What do you mean by this? What IP address are you referring to? @Kristin , to add onto this: You said that " my Meraki WILL connect to my att internet router". What happens on the front of the device? Does the LED light ever turn white or does it rainbow and then stay orange? What does your IT team see when you plug in your device? Are they able to see any traffic on the device? I have many users in my organization that use Z3s connected straight to their router without any additional devices. I know a few have AT&T. I don't recall having to do anything special to get their devices connected. I will double-check with them when they clock in shortly. Kudos for you for hopping on the forum and trying to troubleshoot the issue! I'm sure it is very frustrating, but I hope that we will be able to help you out and get this solved!
... View more
10-15-2019
07:15 AM
7 Kudos
I know this isn't adding anything to the conversation, but this is probably my favorite thread on the forums thus far.
... View more
10-05-2019
09:40 AM
@PhilipDAth , not sure how it's a wide use case or require changing anything in the GUI in terms of loss and latency. You already get that information in the MX. Should be just as simple as adding it as an option under Network-wide > Configure > Alerts. If we can get an option to say "Send e-mail when a port has been down for 5 minutes", you should be able to add something similar for loss and latency (i.e. if you detect 5% loss for 10 minutes). Network saturation on the other hand, that's a heavier lift and I do agree with you there @PhilipDAth, that is a much wider use case.
... View more
09-25-2019
04:59 AM
Hi @Nick , The setup is reasonably easy. One thing to keep in mind is that if you are using your work email address to access the dashboard and also intend to use it in SAML, you will have to do one or the other. One way to do it is using a service account not attached to SAML and have all admins in the SAML group. A couple pointers from the documentation: Limited Single Logout (SLO) is available. Dashboard will use the SLO URL to redirect users after they logout of Dashboard, and then can be used to link into SLO with the IdP if supported, but Dashboard does not support receiving SAML LogoutRequests from the IdP. Only SAML 2.0 is supported. Dashboard only supports IdP-Init. Users must first authenticate with the IdP and then be passed to Dashboard with a valid token. While IdP platforms may have a variety of other fields, in most cases they can be left blank or at default settings. Only the above information is critical for Dashboard compatibility. SAML SSO for MSPs SAML does support the use of multiple organizations. Similarly to traditional logins, it needs to determine that the user is identical across the affected organizations. Thus, for this to occur, the following must be identical across the designed organizations: X.509 cert fingerprint for the organization SAML administrator role (as only one role attribute can be used in the token) The permissions granted can be different in each Organization, but the role name must be identical When this occurs, the user will be directed to the MSP portal and receive the desired permissions in each organization. The Consumer URL for any of the MSP organizations can be used, as they will all direct the user to the MSP portal.
... View more
09-20-2019
11:10 AM
3 Kudos
If you are not using SAML, I believe you have to delete the admin in each organization in your MSP portal. Could be a bit time consuming if you're looking at 100s of organizations. SAML is the best way to handle this. You can easily add/remove users with various permission levels based on group membership. Here's Meraki's support documentation on SAML integration: Configuring SAML Single Sign-on for Dashboard
... View more
09-17-2019
06:27 AM
2 Kudos
"Port forwarding, 1:1 NAT and 1:M NAT traffic are not inspected by layer 7 rules. So, any external traffic coming from one of the blocked countries will still be seen in your network; traffic will not go out to those countries though." This is a response from the ticket I have had in with Meraki for quite sometime as we are seeing traffic from blocked countries inside of our network. I have brought this up with Meraki in the past and have been told that this is expected behavior. So while theoretically it should block the countries in question, in practice you may still see traffic from those countries coming into your network, but not going out.
... View more
08-26-2019
05:06 AM
2 Kudos
Well since the 8-port Switch has already been brought up, I would design an MX that has the capability to tell me what's plugged into the ports (similar to that of current switch ports).
... View more
08-07-2019
05:47 AM
I feel like we get a new sales rep every 6 months. in the 3 years we've had Meraki in our environment, we've probably have had 6 different reps. Most of our changes have been b/c of promotions so great for those reps, but it is tough having a really good rep who knows your environment to then go back to starting at square one.
... View more
07-16-2019
06:38 AM
A couple of things to try that always work for me: When setting up allow/deny rules, put allow rules up top and deny at the bottom When granting access to a single host, use a /32 on the host versus the /24 Doing these two things usually allow me to make my exceptions with zero issues.
... View more
07-10-2019
10:33 AM
4 Kudos
Congrats to all of our All Stars!!
... View more
07-10-2019
09:23 AM
2 Kudos
@Raj66 , it's a MX65W. We made sure that power cable was unplugged. @NFL0NR can verify! MX65W with no Power. Notice link light activity on Port 11
... View more
07-10-2019
08:43 AM
3 Kudos
Looks like it's time to start posting 🙂
... View more
07-10-2019
08:30 AM
4 Kudos
So @NFL0NR found out something very random this morning: a number of our MX devices were able to be powered via PoE from our Meraki Switch. When plugged into the PoE port (11/12) on the MX device from the PoE on the switch, the MX powered on. We had an Internet uplink in Port 1 and the device was able to completely boot up, grab its config, and be a functioning device in our organization. Not seeing anywhere in the documentation where this was a feature, but we testing it on a number of our devices. Has anyone else seen this before?
... View more
05-13-2019
09:46 AM
2 Kudos
You should have no troubles trying to accomplish this. I am currently using the same summarized subnet across 4 templates. @PhilipDAth is correct in that the AutoVPN routing table is consulted to see if the subnet is available.
... View more
04-11-2019
04:40 AM
Good morning @Vincent , First question I have to ask, under Security & SD-WAN>Configure>Site-to-site VPN, you should see a list of your local networks attacked to the MX64. On your Client VPN, do you have YES selected under the Use VPN column?
... View more
03-25-2019
01:42 PM
2 Kudos
My company moved from WatchGuard XTM 820 to MX600. What would you like to know?
... View more
03-07-2019
02:33 PM
31 Kudos
A bit about yourself & your work I've been in networking for going on 7 years now. Currently I help design and maintain the network infrastructure for my company, as well as take on special projects to help improve our business. Your experience with Cisco Meraki I've been using Cisco Meraki for roughly four years all together. I introduced Meraki to my former company and another tech helped bring in Meraki in my current employer A fun fact about yourself I'm the proud owner of @Maui_Meraki_Dog
... View more
03-06-2019
01:41 PM
1 Kudo
I typically use 1812 as that's the default, but if you used 1645 you would want to match that in the Meraki. As for the vLAN, vLAN 4 would be correct.
... View more
03-05-2019
06:45 AM
4 Kudos
This is a great step towards the more in-depth training that many of us have been asking for! Hopefully the ECMS2 comes to my area soon as I don't think the company will fly me out to Meraki HQ as much as I would love to go!
... View more
03-01-2019
06:16 AM
That is correct.
... View more
02-28-2019
05:35 PM
3 Kudos
Correct, you use AD logins even if using RADIUS. RADIUS is used ALONG WITH AD. AD will be where it looks for the users you assign to the policy, but RADIUS is the one that enforces it. Think of it like this: RADIUS is the bouncer outside the VIP room of a club. It has to look at the exclusive list (AD) to see who gets in and who doesn't (i.e. your policy). Just because you can get into the club (i.e you have AD credentials) doesn't mean you can get into the VIP room (you don't match the policy) As for the Meraki IP you put as the RADIUS client, you would use the private IP. Keep in mind that if you have to go through a VPN tunnel to reach the RADIUS server, your MX IP would be the gateway of your HIGHEST numbered vLAN participating in site-to-site. For example, i f you have vLAN setup: vLAN 10 - gateway 192.168.10.1 vLAN 17 - gateway 192.168.17.1 vLAN 20 - gateway 192.168.20.1 vLAN 35 - gateway 192.168.35.1 vLAN 52 - gateway 192.168.52.1 and all vLANs are participating in site-to-site, the MX IP would be 192.168.52.1 as that is the highest numbered vLAN. IF vLANs 35 and 52 were NOT participating in site-to-site, then the MX IP would be 192.168.20.1 as vLAN 20 is the highest numbered vLAN.
... View more
02-28-2019
11:36 AM
3 Kudos
Hi @tantony , With AD authentication, you will point to one of your DCs for authentication purposes. As long as there is an AD account, the user will be able to connect to the VPN. (Active Directory Integration) With RADIUS, you will point to a RADIUS server for authentication, which allows you to provide a bit more security. You can setup a policy so that only people belonging to a certain AD group (which RADIUS will be pointed to) will be able to connect to VPN. (Configuring RADIUS Authentication with Client VPN) As far as 2FA is concerned, you can use RSA and DUO with the built-in Windows client, although it is limited to the Push or Biometric authentication methods as there is no way to input a code at this time. If you are using Meraki Cloud authentication, you can create multiple accounts for users to use with the VPN. (Managing User Accounts using Meraki Authentication)They do not have to have dashboard access in order to be setup as a VPN user. You should absolutely have individual accounts for each user accessing VPN.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 253 | 09-17-2019 06:27 AM | |
| 3224 | 02-28-2019 05:35 PM | |
| 1995 | 02-26-2019 05:16 AM | |
| 2538 | 06-13-2018 02:12 PM | |
| 1135 | 06-05-2018 08:52 AM | |
| 6600 | 11-15-2017 06:40 AM | |
| 2098 | 11-02-2017 10:50 AM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 31 | 45830 | |
| 19 | 1724 | |
| 16 | 9039 | |
| 15 | 3464 | |
| 14 | 12380 |
